linux-kernel - Re: [PATCH] hfsplus: Fix bug causing custom uid and gid being unable to be assigned with mount

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <A2B962C1-AD33-413D-B64A-CD179AFBEA8D@dubeyko.com>
Date:   Mon, 5 Dec 2022 16:35:36 -0800
From:   Viacheslav Dubeyko <slava@...eyko.com>
To:     Aditya Garg <gargaditya08@...e.com>
Cc:     "willy@...radead.org" <willy@...radead.org>,
        "ira.weiny@...el.com" <ira.weiny@...el.com>,
        "axboe@...nel.dk" <axboe@...nel.dk>,
        "akpm@...ux-foundation.org" <akpm@...ux-foundation.org>,
        "bvanassche@....org" <bvanassche@....org>,
        "keescook@...omium.org" <keescook@...omium.org>,
        "songmuchun@...edance.com" <songmuchun@...edance.com>,
        "torvalds@...ux-foundation.org" <torvalds@...ux-foundation.org>,
        "linux-fsdevel@...r.kernel.org" <linux-fsdevel@...r.kernel.org>,
        "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>
Subject: Re: [PATCH] hfsplus: Fix bug causing custom uid and gid being unable
 to be assigned with mount



> On Dec 2, 2022, at 11:56 PM, Aditya Garg <gargaditya08@...e.com> wrote:
> 
> 
>> Also, what if we mounted
>> file system without specifying the UID/GID, then what UID/GID will be returned by
>> your logic?
> 
> So this case is if I run “sudo mount /dev/sda1 /mnt”
> 
> Here the driver will not do any spoofing, and the real owners of the files shall be displayed. Thus running “ls -l” on a mounted partition without specifying UID/GID, files written by macOS shall be shown as 99 as the owner, iPadOS as 501, and if any file was written on Linux, the user who wrote it will be the owner.
> 
> If the user/group of any file was changed using chown, then the new user/group of the file will be displayed.

My question is much more simple.

diff --git a/fs/hfsplus/inode.c b/fs/hfsplus/inode.c
index aeab83ed1..4d1077db8 100644
--- a/fs/hfsplus/inode.c
+++ b/fs/hfsplus/inode.c
@@ -192,11 +192,11 @@ static void hfsplus_get_perms(struct inode *inode,
	mode = be16_to_cpu(perms->mode);

	i_uid_write(inode, be32_to_cpu(perms->owner));
-	if (!i_uid_read(inode) && !mode)
+	if (test_bit(HFSPLUS_SB_UID, &sbi->flags))
		inode->i_uid = sbi->uid;

	i_gid_write(inode, be32_to_cpu(perms->group));
-	if (!i_gid_read(inode) && !mode)
+	if (test_bit(HFSPLUS_SB_GID, &sbi->flags))
		inode->i_gid = sbi->gid;

Before this change, logic called i_uid_read(inode) and checked mode.
Now, we check only HFSPLUS_SB_UID/HFSPLUS_SB_GID flags.
So, if we mount HFS+ volume by “sudo mount /dev/sda1 /mnt”, then
HFSPLUS_SB_UID and HFSPLUS_SB_GID flags will be unset.
And current logic will do nothing. Is it correct logic? Maybe, we need
to use sbi->uid/gid if flag(s)HFSPLUS_SB_UID/HFSPLUS_SB_GID are set.
And if not, then to use old logic. Am I correct here? Or am I still missing
something here?

Thanks,
Slava.